Tracing a darknet lead on TON means following messages between contracts. Wallets here are smart contracts, so a transfer is a message that one account sends to the next. Start from the address you were given and record its form.
Reading the flow
The free check shows the balance, how many recent transactions it saw and when the latest one happened. Use the latest date to decide whether the trail is warm or cold. Then walk outward through the counterparties in the public record, one hop at a time.
Keeping the trace usable
Write each hop with its address in raw form and its time. A bounceable and a non-bounceable string can point at one account, so a trace that mixes spellings splits a single actor into two. Normalize first.